Subprocessors
Effective from 2026-08-14
What this page covers
This page lists the main service providers ClickMeats uses to run the website, mobile apps, marketplace, payments, notifications, analytics and support operations.
These providers may process personal data on our behalf, or as independent providers where they operate their own regulated service, such as payment processing. We only use them for the purposes shown below.
For the broader explanation of how we use personal data, read our Privacy Policy.
Current subprocessors and service providers
| Provider | Purpose | Data categories | Location / transfer position | Transfer safeguards |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, API hosting, Lambda compute, database storage, file storage, monitoring, secrets, backups and authentication infrastructure. | Account data, order data, merchant data, shop data, support/admin data, documents uploaded for merchant onboarding, technical logs and configuration data. | Primary production infrastructure is configured in AWS Europe (London), eu-west-2. | AWS data processing terms and applicable UK/EU transfer safeguards where any support or operational access involves a restricted transfer. |
| Amazon Cognito | Customer and merchant authentication, sign-in, account verification and password reset. | Name, email address, phone number, account identifiers, authentication metadata and password hashes. | Configured in AWS Europe (London), eu-west-2, as part of the ClickMeats AWS environment. | AWS data processing terms and applicable UK/EU transfer safeguards where any support or operational access involves a restricted transfer. |
| Stripe | Payment processing, fraud prevention, payment authentication, refunds, receipts, connected merchant accounts and payouts. | Payment details, payment method data, billing/contact data, order amount, payment references, refund data, fraud and verification data, and merchant payout/onboarding data. | Stripe may process data in the UK, EEA, United States and other locations needed to provide payment services. | Stripe data processing terms, payment-services terms and applicable UK/EU transfer safeguards. |
| Resend | Transactional email delivery for receipts, order updates, refunds, account and merchant communications. | Recipient email address, email subject, email body, delivery status, message metadata and related technical logs. | Resend may process data in the United States and other locations used to provide email delivery. | Resend data processing terms and applicable UK/EU transfer safeguards. |
| Vercel | Website hosting, deployment, edge delivery, routing, static asset delivery and website request logs. | IP address, browser/device metadata, request metadata and limited technical logs. Order and account records remain in AWS and are not intentionally cached by Vercel. | Vercel uses global edge infrastructure and may process limited request data outside the UK/EEA. | Vercel data processing terms and applicable UK/EU transfer safeguards. |
| PostHog EU Cloud | Opt-in product analytics to understand how users interact with the website and mobile apps. | Pseudonymous usage events, page/screen views, button clicks, device/browser metadata and analytics identifiers. Analytics is disabled unless the user opts in. | PostHog EU Cloud. The current intended hosting region is the European Union. | PostHog data processing terms. Analytics remains opt-in and is not used for advertising tracking. |
| Sentry | Error monitoring, crash reporting, performance diagnostics and technical fault investigation. | Crash/error data, stack traces, device/browser metadata, performance data, user/session identifiers where configured, and limited technical context. Sentry Session Replay is disabled. | Sentry may process data in the United States, EEA and other locations used to provide diagnostics services. | Sentry data processing terms and applicable UK/EU transfer safeguards. |
| Google Firebase / Firebase Cloud Messaging | Android push-notification delivery and mobile messaging infrastructure. | Push-notification tokens, device identifiers, message metadata and delivery diagnostics. | Google may process data globally to provide Firebase and messaging services. | Google/Firebase data processing terms and applicable UK/EU transfer safeguards. |
| Apple Push Notification service (APNs) | iOS push-notification delivery. | APNs device tokens, notification metadata and delivery diagnostics. | Apple may process data globally to provide push-notification services. | Apple developer and service terms and applicable transfer safeguards where required. |
| Cloudflare | DNS, domain security, DDoS protection and traffic routing. | IP address, DNS/request metadata, security logs and technical routing data. | Cloudflare uses global network infrastructure and may process limited technical data outside the UK/EEA. | Cloudflare data processing terms and applicable UK/EU transfer safeguards. |
| Namecheap | Domain registration and business email services used by ClickMeats. | Business contact details, domain registration data and email account/service metadata where used. | Namecheap may process data in the United States and other locations used to provide domain and email services. | Namecheap service terms, privacy terms and applicable transfer safeguards where required. |
International transfers
ClickMeats uses UK and European hosting where practical, including AWS Europe (London) for the main production backend. Some providers may process limited data outside the UK or EEA because they operate global infrastructure or provide regulated payment, email, security, analytics, notification or support services.
Where a restricted international transfer is involved, we rely on the provider's data processing terms and the applicable transfer safeguards, such as UK/EU standard contractual clauses, the UK International Data Transfer Addendum, adequacy regulations, or equivalent safeguards made available by the provider.
We keep an internal transfer assessment for the providers above and review it when we add, remove or materially change a provider.
Changes to this list
We update this page when we add, remove or materially change a subprocessor. If a change materially affects how your personal data is processed, we will update the effective date and provide any notice required by law or by our contracts.
Contact
Questions about this list or how ClickMeats uses service providers can be sent to admin@clickmeats.co.uk.